CVE-2026-30892: 
NixOS vulnerability analysis and mitigation

CVE-2026-30892 is a privilege escalation vulnerability in crun, an open-source OCI Container Runtime written in C. The flaw causes the crun exec -u (--user) option to incorrectly parse user specifications, resulting in processes running as UID 0 (root) instead of the intended unprivileged UID. It affects crun versions 1.19 through 1.26, and was disclosed on March 25–26, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) per Feedly threat intelligence data, though the GitHub Security Advisory assigned it a Low severity with a score of 0.0 based on a different CVSS vector (GitHub Advisory, Feedly).

The root cause is an improper privilege management bug (CWE-269) in the make_oci_process_user() function within src/exec.c. Specifically, the function returns the user struct u on line 218 before u->uid has been assigned, meaning the UID field retains its zero-initialized default value (UID 0, GID 0) rather than the parsed value. This regression was introduced in commit 85d4db3 and fixed in commit 1bd7f42. An attacker with local access and permission to run crun exec can exploit this by specifying -u 1 (or any non-zero UID), causing the container process to execute as root instead of the intended user (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated user with permission to execute containers via crun to escalate privileges within the container, running arbitrary commands as UID 0 (root) instead of the specified unprivileged user. This undermines container isolation and user-based access controls, potentially enabling unauthorized access to sensitive files, modification of container state, or further exploitation of the host if combined with other vulnerabilities. The confidentiality, integrity, and availability of the affected container environment are all at high risk (Feedly, GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the vulnerability with a reproducible bash script on Fedora 43 systems using Podman and crun. The PoC confirms that running bash /tmp/reproduce.bash crun 1 outputs UID 0 instead of the expected UID 1. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Identify a vulnerable system: Confirm the target is running crun versions 1.19–1.26 with Podman or another container runtime that uses crun as its OCI runtime backend.
2. Obtain local access: Gain access as a non-root user who has permission to execute containers (e.g., a user in the wheel or container-capable group).
3. Start a container: Launch a background container using Podman with crun as the runtime: ctr=$(podman --runtime crun run --rm -q -d docker.io/library/alpine sleep 10)
4. Execute with crafted user flag: Run crun exec -u 1 $ctr id -u within a podman unshare context: podman --runtime crun unshare crun exec -u 1 $ctr id -u
5. Observe privilege escalation: The command returns 0 (root) instead of 1, confirming the process is executing as UID 0 rather than the specified UID 1.
6. Leverage root access: Use the root-privileged shell within the container to access sensitive files, modify container configuration, or attempt container escape if additional misconfigurations exist (GitHub Advisory).

• Logs: Container runtime logs showing crun exec -u <non-zero UID> commands where the resulting process UID is 0; audit logs (auditd) recording unexpected UID 0 process executions within containers.
• Process: Container processes running as UID 0 when the workload or orchestration policy specifies a non-root user; unexpected root-owned processes spawned inside containers configured with non-root users.
• File System: Unexpected file modifications or creations within containers that should only be writable by root; new files owned by UID 0 in container-writable directories.
• Network: Outbound connections from containers that are normally restricted to unprivileged users, potentially indicating post-exploitation activity following privilege escalation (GitHub Advisory, Feedly).

Upgrade crun to version 1.27 or later, which contains the fix in commit 1bd7f42 (crun Release 1.27). Red Hat has issued security errata (RHSA-2026:6621 and RHSA-2026:19020) for affected RHEL-based distributions, and openSUSE/SUSE have also released updated packages. As an interim workaround, restrict access to crun exec commands and avoid relying on the -u flag for privilege separation until patching is complete. Audit container execution logs for crun exec -u invocations to detect potential misuse (GitHub Advisory, Red Hat Errata).

Red Hat issued security advisories (RHSA-2026:6621 and RHSA-2026:19020) addressing the vulnerability in their container tooling packages, indicating broad downstream impact across enterprise Linux distributions. openSUSE and AlmaLinux also released updated crun packages. The vulnerability was reported by security researcher eriksjolund and credited in the GitHub advisory. Coverage appeared on Linux-focused security news sites including pro-linux.de and linuxcompatible.org, though broader mainstream security media coverage was limited given the relatively low severity rating assigned by the upstream project (Red Hat Errata, GitHub Advisory).